At present different solutions to ensure the identity of persons when performing electronic transactions, such as to access to consult or to manage a bank account through the network are known.
For example, U.S. Patent Application No. US2006/0053281 describes an existing communication device, such as a WAP-enabled mobile phone, or other device, that can be used as authentication token. This document describes the use of a mobile device as authentication device based on its wireless public password infrastructure (WPKI) already present in the device; then the device can generate independent session passwords used to encrypt the messages to be transmitted and to decode the messages received. However, the mobile device can be tricked to generate independent session passwords by request of false authentication.
Another solution is illustrated in U.S. Patent Application No. US 2008/0307515, which describes a method for authenticating a user. The method comprises the step of sending a request for authentication to a remote authentication device and generating a first piece of authentication information. A mobile device receives the first piece of authentication information from an access terminal or a remote authentication device. The user's mobile device generates a second piece of authentication information which is at least partially based on the first piece of authentication information. The second piece of authentication information is sent to the remote authentication device and the second piece of authentication information is validated. It is noted that the method comprises sending a first piece of authentication information to a mobile device, such as a visual code; however, it does not identify or detail how this first piece of authentication information may be considered genuine, this being why vulnerability is observed in the method disclosed. Although it is mentioned that better security can be implemented between the remote device and the mobile device authentication using asymmetric cryptography where a cryptographic public password would be stored in the remote authentication device and a private password would be stored in the mobile device. It is not indicated how such asymmetric encryption would be done, and how a private password could be securely transmitted to be stored in a mobile device and thus ensuring the authenticity of the first piece of information sent.
It is noted that a vulnerability exists in the prior art methods to ensure that the information transmitted between a mobile device and a server is genuine to validate a connection terminal.